#11435 Validate unauthenticated public API responses before use
Unauthenticated external API responses are now validated for size, schema, and integrity before being used in tax and financial processing. The hardening covers VIES VAT validation, currency exchange rates, Nemhandel company status, and MTD fraud prevention endpoints.
- 13files
- 5AL files
- 5objects
Pull request · merged into main (BC30) on 2026-09-18 by dcenic · 13 files (+1195 -55), 5 AL · fix · tier official · reviewed (checked by Opus)
What changed
- Size caps on external responses: 64 KB for VIES and Nemhandel, 10 MB for currency exchange rates, 4 KB for the MTD public IP lookup
- VIES responses must echo the requested country code and VAT number, otherwise they are rejected
- Nemhandel responses must contain a cvrNummer matching the requested CVR; MTD exits early on non-2xx responses
- Every rejection emits telemetry and a Security Audit entry; Nemhandel telemetry no longer logs the request URI or reason phrase
- Tests added for size, schema and integrity checks, including CZ, ES and NA VAT test copies
- Behaviour changes for users or extensions.
AL objects touched
- Codeunit 13608 “Nemhandel Status Page Bckgrnd”, NemhandelNotification (DK layer): modified
- Codeunit 10541 “MTD Fraud Prevention Mgt.”, UKMakingTaxDigital (GB layer): modified
- Codeunit 1281 “Update Currency Exchange Rates”, Base Application: modified
- Codeunit 248 “VAT Lookup Ext. Data Hndl”, Base Application: modified
- Codeunit 249 “VAT Registration Log Mgt.”, Base Application: modified
Context
- Work items: AB#648731
- Labels: Team: Finance
- Systems: finance, development, integration
Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).